The audit, and the limits of an audit

Graduate · enrolled learners

This lesson opens with Akropolis, November 2020.

What happened

Akropolis ran savings pools that let users deposit tokens, and the deposit logic accepted an arbitrary token address and credited the depositor before the pool's own accounting had fully settled. An attacker supplied a malicious token whose transfer function called back into the deposit logic mid-transaction, a reentrancy, so a single deposit was counted several times over, letting the attacker be credited for funds they never actually paid, and drain about 2 million dollars in DAI. Akropolis had been audited. The audit had not been useless and the team had not been negligent in skipping it; the flaw simply fell in a place the review did not fully catch, because an audit is a point-in-time examination of a defined scope by fallible people, not a proof that no bug exists. The word 'audited' had been on the project, and the reentrancy was there anyway, because the audit reduced the risk without removing it, which is the most an audit can do.

The decision point

An audit is a point-in-time review of a defined scope by skilled but fallible people, so it reduces the probability of a serious bug without ever removing it, which means 'audited' is not a synonym for 'safe,' and treating it as one is a mistake both for builders relying on their own audit and for users trusting someone else's. Akropolis is the case: a project that had been audited was drained of about 2 million dollars by a reentrancy flaw, because the audit, real and valuable as it was, did not catch that particular bug in that particular interaction, and no audit guarantees that it will. This lesson sits in the handoff course because it corrects the belief a little knowledge tends to produce, that getting an audit is the box you check to be safe. In truth an audit is one layer among several: it examines a specific version of specific code for a bounded time, and it is only as good as its scope, its depth, its reviewers, and the questions asked, so a bug outside the scope, introduced after the review, or simply missed, survives it. So the discipline is to understand what an audit is and is not: to ask, for any audit, what code and what version it covered, what it explicitly did not cover, who performed it and how deeply, and what has changed since, rather than reading the single word 'audited' as a guarantee. Akropolis is what the word alone is worth when the reentrancy is still in the code: about 2 million dollars, because an audit lowers risk and a reader who mistakes it for the removal of risk has not read the audit at all.

Recorded loss

$2,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.